GHSA-FH32-35W2-RXCC Use of Password Hash With Insufficient Computational Effort in Apache Derby

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

SSH SHA-1 HMAC Algorithms Enabled (PCI DSS)

The remote SSH server is configured to enable SHA-1 HMAC algorithms. Although NIST has formally deprecated use of SHA-1 for digital signatures, SHA-1 is still considered secure for HMAC as the security of HMAC does not rely on the underlying hash function being resistant to collisions. Note that...

Cross-site Scripting (XSS)

jenkins Git Plugin is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause...

gnutls security update

3.6.16-4.0.1fips - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 Orabug: 33200526 - Allow bigger known RSA modulus sizes when calling rsageneratefips1864keypair directly Orabug: 33200526 - Change Epoch from 1 to 10...

OPENSUSE-SU-2021:1642-1 Security update for postrsd

postrsd was updated to release 1.11 boo1180251: Drop group privileges as well as user privileges Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. CVE-2020-35573 - Update to release 1.6 Fix endianness issue with SHA-1 implementation Add dual stack...

Security update for postrsd (moderate)

openSUSE Security Update: Security update for postrsd Announcement ID: openSUSE-SU-2021:1642-1 Rating: moderate References: 1180251 Cross-References: CVE-2020-35573 CVSS scores: CVE-2020-35573 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ...

Cross-Site Scripting (XSS)

laravel/framework is vulnerable to cross-site scripting XSS. When the parent template contains an exploitable HTML structure, a remote attacker is able to inject arbitrary Javascript via guessing the parent placeholder SHA-1 hash by trying common names of sections...

Use of Sha-1 in tusdotnet

Withdrawn After reviewing this CVE, we have withdrawn this advisory due to it not having actual security impact. Original Advisory The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

GHSA-FRCX-XC72-C4V4 Use of Sha-1 in tusdotnet

Withdrawn After reviewing this CVE, we have withdrawn this advisory due to it not having actual security impact. Original Advisory The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

Content Spoofing

tusdotnet is vulnerable to content spoofing. Remote attackers are able to conduct tampering attacks and alter the checksum which makes it possible to alter the file being uploaded itself. The vulnerability exists because tus client uses the SHA-1 hash function with weak collision resistance...

CVE-2021-44150

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

CVE-2021-44150

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

Spoofing

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

CVE-2021-44150

The CVE-2021-44150 issue affects tusdotnet up to version 2.5.0, where the client relies on SHA-1 to prevent spoofing of file content. The available sources describe Content Spoofing risk stemming from weak collision resistance of SHA-1 and link this to tusdotnet’s upload integrity checks. The con...

CVE-2021-44150

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content...

Jenkins Git Plugin < 4.8.3 XSS

According to its its self-reported version number, the version of the Jenkins Git Plugin running on the remote web server is prior to 4.8.3. It is, therefore, affected by a cross-site scripting vulnerability due to it not escaping the Git SHA-1 checksum parameters provided to commit notifications...

CVE-2021-21684

A stored cross-site scripting XSS vulnerability was found in the Jenkins Git plugin. Due to not escaping the Git SHA-1 checksum parameters provided to commit notifications, an attacker is able to submit crafted commit notifications to the /git/notifyCommit endpoint...

CVE-2021-21684

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting XSS vulnerability...

Cross site scripting

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting XSS vulnerability...

Use of a Broken or Risky Cryptographic Algorithm in anonaddy/anonaddy

Description MD5 and SHA-1 are popular cryptographic hash algorithms often used to verify the integrity of messages and other data. Recent advances in cryptanalysis have discovered weaknesses in both algorithms. Consequently, MD5 and SHA-1 should no longer be relied upon to verify the authenticity...